TunnelSnake

Linked to China by two sources.

Reports: 4
Last reported: 6 April 2026
Known CVEs: 1
Origin: China

ID: tunnelsnake
Sources: MISP Malpedia
Merge evidence: 1 alias match

Reports per quarter

2021 Q2: 3 reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 1 report

Dated reports, 2021 Q2 to 2026 Q2.

CVEs named in reports

CVE-2017-7269 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Operation TunnelSnake - RedPacket Security

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Operation TunnelSnake - RedPacket Security
6 May 2021

Operation TunnelSnake _ Securelist

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation TunnelSnake _ Securelist
6 May 2021

Operation TunnelSnake

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Operation TunnelSnake
6 May 2021

Operation TunnelSnake

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation TunnelSnake

Newest first. Details opens the report in Explore.